ms2k/lazaret
SHA256
Watch
0
Code Releases 3 Activity

Bind sandbox handoff authority and restore verifier gates

Browse source
This commit is contained in:
ms2k 2026-07-16 15:20:13 +09:00
commit 49d5def1a9
1 changed files with 951 additions and 170 deletions
Download patch file Download diff file Expand all files Collapse all files

34
crates/lazaret-runtime-supervisor/src/supervision.rs
View file

@ -162,10 +162,12 @@ impl CoordinatorChannel {
pub struct RuntimeSupervisorLaunch {
target: TargetCommand,
ownership: ProcessOwnershipContext,
_policy_file: Option<File>,
policy_file: Option<File>,
network_sidecar_id: Option<NetworkSidecarId>,
runsc_command: RunscCommand,
}
#[derive(Clone, Copy)]
pub struct RuntimeNetworkLaunch<'policy> {
pub policy: &'policy CanonicalDerivedNetworkPolicy,
pub configuration_fingerprint: ConfigurationFingerprint,
@ -210,8 +212,9 @@ impl RuntimeSupervisorLaunch {
Ok(Self {
target: target.with_lifetime_pipe_parent_edge(),
ownership,
_policy_file: None,
policy_file: None,
network_sidecar_id: None,
runsc_command: command.clone(),
})
}
@ -256,7 +259,7 @@ impl RuntimeSupervisorLaunch {
}
launch.target = launch.target.with_lifetime_pipe_parent_edge();
drop(target);
launch._policy_file = Some(policy_file);
launch.policy_file = Some(policy_file);
launch.network_sidecar_id = Some(network.network_sidecar_id);
Ok(launch)
}
@ -276,6 +279,11 @@ impl RuntimeSupervisorLaunch {
self.network_sidecar_id
}
#[must_use]
pub const fn runsc_command(&self) -> &RunscCommand {
&self.runsc_command
}
/// # Errors
/// Refuses a Runtime Supervisor target without the lifetime-pipe parent edge.
pub fn child_standard_io(
@ -557,14 +565,11 @@ fn prepare_runtime_network(
Ok(message) => message,
Err(error) => return fail_network(Some(prepared), error),
};
let request = match message {
CoordinatorMessage::NetworkAttestationAccepted(request) => request,
_ => {
return fail_network(
Some(prepared),
io::Error::other("network attestation acceptance was not received"),
);
}
let CoordinatorMessage::NetworkAttestationAccepted(request) = message else {
return fail_network(
Some(prepared),
io::Error::other("network attestation acceptance was not received"),
);
};
let probe = match probe_current_network(&request) {
Ok(probe) => probe,
@ -896,7 +901,12 @@ mod tests {
let launch = RuntimeSupervisorLaunch {
target: TargetCommand::new("/proc/self/exe").with_lifetime_pipe_parent_edge(),
ownership,
_policy_file: None,
policy_file: None,
runsc_command: RunscCommand::new(
"runsc",
[OsString::from("run"), OsString::from("container")],
[0; 32],
),
network_sidecar_id: None,
};
let (_coordinator_control, supervisor_control) = private_seqpacket_pair().unwrap();